Re: [PATCH v3 12/13] livepatch/klp-build: report patch validation drift

[Joe Lawrence <joe.lawrence@redhat.com>]

On Tue, Feb 17, 2026 at 11:42:21AM -0800, Song Liu wrote:
> On Tue, Feb 17, 2026 at 8:07 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
> >
> > Capture the output of the patch command to detect when a patch applies
> > with fuzz or line offsets.
> >
> > If such "drift" is detected during the validation phase, warn the user
> > and display the details.  This helps identify input patches that may need
> > refreshing against the target source tree.
> >
> > Ensure that internal patch operations (such as those in refresh_patch or
> > during the final build phase) can still run quietly.
> >
> > Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
> > ---
> >  scripts/livepatch/klp-build | 24 +++++++++++++++++++-----
> >  1 file changed, 19 insertions(+), 5 deletions(-)
> >
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index fd104ace29e6..5367d573b94b 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
> > @@ -369,11 +369,24 @@ check_unsupported_patches() {
> >
> >  apply_patch() {
> >         local patch="$1"
> > +       shift
> > +       local extra_args=("$@")
> > +       local drift_regex="with fuzz|offset [0-9]+ line"
> > +       local output
> > +       local status
> >
> >         [[ ! -f "$patch" ]] && die "$patch doesn't exist"
> > -       patch -d "$SRC" -p1 --dry-run --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > -       patch -d "$SRC" -p1 --silent --no-backup-if-mismatch -r /dev/null < "$patch"
> > +       status=0
> > +       output=$(patch -d "$SRC" -p1 --dry-run --no-backup-if-mismatch -r /dev/null "${extra_args[@]}" < "$patch" 2>&1) || status=$?
> > +       if [[ "$status" -ne 0 ]]; then
> > +               echo "$output"
> > +               die "$patch did not apply"
> > +       elif [[ "$output" =~ $drift_regex ]]; then
> > +               warn "$patch applied with drift"
> > +               echo "$output"
> > +       fi
> 
> It appears we only need the non-silent "patch" command and the reporting
> logic in validate_patches(). Maybe we can have a different version of
> apply_patches for validate_patches(), say apply_patches_verbose(), and
> keep existing apply_patch() and apply_patches as-is?
> 

Yes, you're right about the reporting cases.  Splitting might be
cleaner, I'll consider for v4.  This logic does get a little hairy to
handle the two cases of when we want to see output vs. not.  (set -o
errexit forces us to disarm anything that might throw an error and bring
down the whole show.) 

--
Joe